Proposal for Alternative Smmtt

Version 0.2-draft-20240430

Table of Contents


Smmtt is a RISC‑V Machine mode (M-mode) proposal for providing access control without translation on the physical address space of a system. In this it is similar to PMP, but intended for many more regions than PMP can support. It is based on multilevel tables, similar to the Sv39/Sv48/Sv57 page tables, except only a 2 or 4‑bit access permission is stored at the final level. The current Smmtt proposal uses fixed 3‑level or 2‑level table structures for 4 modes and supports physical address spaces up to 56 bits. This alternative Smmtt proposal makes the table structure more flexible by allowing the M-Mode software to specify the multilevel table structure and supports any physical address space size up 64 bits. For example, it is possible to have a single large table if that is appropriate, based on the amount of physical memory in the system, or one table for main memory and one for I/O space in another use case. Page sizes of 4 KiB, 2 MiB, and 1 GiB are supported by the current Smmtt, but not other sizes that a TLB might support (e.g. via Svnapot).

This proposal outlines an alternative only for RV64. The extension for RV32 and RV128 can be done if others are interested in pursuing this alternative.

Pros and Cons



Alternate Proposal

As in Smmtt, PAW is used to designate the number of bits in a physical address:

Physical Address
63 0
0 PA

This extension would be enabled by a bit in the mseccfg CSR.

We start with the assumption that the M-mode software will designate one or more regions of the address space to be subject to access control. Typically this would be the entire PAW-bit physical address space with one structure, but could be handled with two or more structures. Multiple structures would allow access control for different portions of the address space to be changed independently, which might be useful in some situations. A given processor might support 1-8 regions via 1-8 Access Control Match CSRs macm0 to macm7. (Most processors would implement only 1 or 2 macm registers, and their corresponding mact registers.) The format of the macm registers is as follows using a NAPOT encoding of the bits to compare when testing for a match. Each macm register specifies a SDID for caching purposes.

macm registers are WARL. The number of SDID bits can be determined by writing all 1s to bits 7:0 and seeing which read back as 1. An implementation may hardwire the paddr field of the last or only macm register, e.g. to force a match of the entire physical address space.

Access Control Match Register
63 11 10 9 8 7 0
0 paddr[PAW−1:12+S] 2S L 0 SDID
64−PAW PAW−S 1+S 1 2 8
Fields of macm registers
Field Width Bits Description
SDID 8 7:0 Supervisor Domain ID
L 1 10 Lock
2S 1+S 11+S:11 NAPOT encoding of physical address region to match
paddr[PAW−1:12+S] PAW−S PAW−1:12+S Physical address to match

When bits PAW−1:12+S of a physical address match the same bits of an macm register, then the corresponding mact register specifies a table to use for the access rights. The value of S comes from the NAPOT encoding of macm registers, as the number zero bits starting from bit 11 (i.e., S=0 if bit 11 is 1, S=1 if bits 12:11 are 10, and so on). Setting bits PAW-1:11 to 2PAW-12 (1000–0) causes it to match the entire physical address space. The lowest numbered macm match has priority. If no macm register matches when this extension is enabled in mseccfg, then it is equivalent to no access.

On a match to macmi, the corresponding macti is used to determine access according to the XWR field. If a table lookup is specified, H is set to 12+S and a doubleword is read from {taddr[PAW-1:5+T],PA[H-1:H-T],3'b0}, and H is decremented by T. This process is iterated until a leaf node is reached. The format of mact registers is as follows:

Access Control Table Pointer
63 4 3 0
0 taddr[PAW−1:5+T] 2T Type
64−PAW PAW−T 1+T 4
Fields of mact registers
Field Width Bits Description
XWR 4 3:0 Permissions/Type with PTE-like encoding:
0 Access denied (taddr reserved)
1 Read-only (taddr[PAW-1:5+T] required to match the physical address bits PAW-1:5+T)
2 taddr is pointer to next-level table of size 2T doublewords. The next T bits of the physical address are used to index the table. In particular a doubleword is read from {taddr[PAW−1:5+T],PA[H−1:H−T],3'b0},
H is decremented by T, and the process iterates on that value.
3 Read and write (taddr[PAW-1:5+T] required to match the physical address bits PAW-1:5+T)
4 Execute only (taddr[PAW-1:5+T] required to match the physical address bits PAW-1:5+T)
5 Read and Execute (taddr[PAW-1:5+T] required to match the physical address bits PAW-1:5+T)
6 taddr is pointer to last-level table of size 25+T bytes with 4‑bit access control entries
7 Read, Write, and Execute (taddr[PAW-1:5+T] required to match the physical address bits PAW-1:5+T)
8..13 Reserved
14 taddr is pointer to last-level table of size 25+T bytes with 2‑bit access control entries
14..15 Reserved
2T 1+T 4+T:4 For XWRs 2, 6, and 14, NAPOT encoding of next or last level table size. For XWRs 0, 1, 3, 4, 5, and 7, this is a Svnapot-like indicator from software that 2T aligned entries of the table have the identical T and XWR field values.
taddr[PAW−1:5+T] PAW−T PAW−1:5+T Pointer to next or last level table size for XWRs 2, 6, and 14.

When XWR 2 is used to indicate a next level table, the format of the table entries has the same interpretation as mact above.

For XWRs 0, 1, 3, 4, 5, and 7, the specified access applies to physical addresses matching the high bits PA[PAW-1:H+T]. Thus the T is still used in these entries to implement a Svnapot-like larger region size. This requires software to make 2T aligned entries of the table to have identical T and XWR fields.

The last level table specified by XWR 6 or XWR 14 has an implicit region size associated with each entry given by the number of physical address bits remaining after the bits used to index the table. This region size must be ≥4 KiB. For page sizes >4 KiB, the 4‑bit or 2‑bit access control bits specify access rights for the entire region. If this region size is not supported by a given implementation’s TLB, it should write the next smaller supported page size.

Types 1, 3, 4, 5, and 7 require taddr[PAW-1:5+T] to match the physical address bits PAW-1:5+T to allow a future extension where taddr provides a translation.

Compatibility with Original Proposal

The original specification can be completely replicated with a minimal configuration of the proposed specification. The following illustrates how the original fields map to the proposed fields.

Things to Consider

Valid XHTML 1.1 Valid CSS!
<webmaster at>
No Junk Email!